Vulnerability · Published Sep 6, 2026 · Assigned by PostgreSQL

CVE-2026-19634PostgreSQL Anonymizer: SQL injection in import_database_rules() and import_roles_rules() via crafted object names / JSON

Medium 6.4

In plain English

A medium-severity SQL injection in PostgreSQL Anonymizer from DALIBO. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities).

Severity (CVSS 3.1)6.4Medium

Exploit odds (30 days)0.3%top 75.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

PostgreSQL Anonymizer contains a SQL injection vulnerability in two import functions. A user can create a malicious JSON document containing specially crafted object names. If a superuser subsequently calls anon.import_database_rules() or anon.import_roles_rules(), the malicious code is executed with superuser privileges. The issue is fixed in PostgreSQL Anonymizer 3.1.4 and later

Affected products (as reported)

Vendor	Product	Versions
DALIBO	PostgreSQL Anonymizer	1 – before 3.1.4

Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H

References

https://gitlab.com/dalibo/postgresql_anonymizer/-/issues/665